Buggy code:
@ Value ( "${baseUri}" ) private String baseUri ; @ Value ( "${version}" ) private String version ; private static final Logger logger = LoggerFactory . getLogger ( UserManagementController . class ) ; private int usersPerPage = 15 ; @ RequestMapping ( "//login" ) public String getLogin ( @ RequestParam ( required = false ) String r , ModelMap model ) { } @ RequestMapping ( "//loginfailed" ) public String loginerror ( ModelMap model ) { } @ RequestMapping ( "//register" ) public String register ( @ RequestParam ( required = false ) String r , ModelMap model ) { } @ RequestMapping ( "//checkRegisterForm" ) public String checkRegisterForm ( HttpServletRequest request , @ RequestParam ( required = false ) String r , RedirectAttributes redirectAttributes , ModelMap model ) { } @ RequestMapping ( "//redirect" ) public String redirect ( @ RequestParam ( required = false ) String r ) { } @ RequestMapping ( "//userManagement" ) public String getUserManagement ( @ RequestParam ( required = false ) String sort , @ RequestParam ( required = false ) boolean isDescending , @ RequestParam ( required = false ) Integer page , @ RequestParam ( required = false ) String showUser , @ RequestParam ( required = false ) boolean deleteUser , @ RequestParam ( required = false ) String deleteUserId , ModelMap model ) { } @ RequestMapping ( "//editUser" ) public String getEditUser ( @ RequestParam ( required = true ) String username , @ RequestParam ( required = false ) String r , ModelMap model ) { } @ RequestMapping ( "//checkEditUserForm" ) public String checkEditUserForm ( HttpServletRequest request , @ RequestParam ( required = true ) String username , @ RequestParam ( required = false ) String r , ModelMap model ) { User user = userDao . findByUsername ( username ) ; if ( user == null ) return "register" ; boolean adminEdit = isAdminEdit ( ) ; boolean userEdit = isUserEdit ( username ) ; String newFirstname = request . getParameter ( "edit_user_firstname" ) ; String newLastname = request . getParameter ( "edit_user_lastname" ) ; String newInstitution = request . getParameter ( "edit_user_institution" ) ; String newEmail = request . getParameter ( "edit_user_email" ) ; String newUsername = "" ; String newPassword = "" ; String newPasswordConfirmation = "" ; boolean isEnabled = false ; List < GrantedAuthority > authorities = new ArrayList < GrantedAuthority > ( ) ; List < RecordGroup > recordGroups = ( ( List < RecordGroup > ) ( recordGroupDao . findAll ( ) ) ) ; Map < String , Boolean > recordGroupValues = new HashMap < String , Boolean > ( ) ; if ( adminEdit ) { newUsername = request . getParameter ( "edit_user_username" ) ; isEnabled = ( request . getParameter ( "edit_user_activated" ) ) != null ; authorities . add ( new SimpleGrantedAuthority ( "ROLE_USER" ) ) ; if ( ( request . getParameter ( "edit_user_role_admin" ) ) != null ) authorities . add ( new SimpleGrantedAuthority ( "ROLE_ADMIN" ) ) ; if ( ( request . getParameter ( "edit_user_role_editor" ) ) != null ) authorities . add ( new SimpleGrantedAuthority ( "ROLE_EDITOR" ) ) ; if ( ( request . getParameter ( "edit_user_role_reisestipendium" ) ) != null ) authorities . add ( new SimpleGrantedAuthority ( "ROLE_REISESTIPENDIUM" ) ) ; List < String > selectedRecordGroupIds = new ArrayList < String > ( ) ; if ( ( request . getParameterValues ( "edit_group_admins" ) ) != null ) selectedRecordGroupIds = new ArrayList < String > ( Arrays . asList ( request . getParameterValues ( "edit_group_admins" ) ) ) ; for ( RecordGroup recordGroup : recordGroups ) { if ( selectedRecordGroupIds . contains ( recordGroup . getId ( ) ) ) { recordGroupValues . put ( recordGroup . getId ( ) , true ) ; GroupRole existingRole = groupRoleDao . findByGroupIdAndUserId ( recordGroup . getId ( ) , user . getId ( ) ) ; if ( existingRole == null ) { GroupRole adminRole = new GroupRole ( ) ; adminRole . setGroupId ( recordGroup . getId ( ) ) ; adminRole . setUserId ( user . getId ( ) ) ; adminRole . setRoleType ( "admin" ) ; groupRoleDao . save ( adminRole ) ; } else { existingRole . setRoleType ( "admin" ) ; groupRoleDao . save ( existingRole ) ; } } if ( ! ( selectedRecordGroupIds . contains ( recordGroup . getId ( ) ) ) ) { recordGroupValues . put ( recordGroup . getId ( ) , false ) ; GroupRole role = groupRoleDao . findByGroupIdAndUserId ( recordGroup . getId ( ) , user . getId ( ) ) ; <START_BUG> if ( role . getRoleType ( ) . equals ( "admin" ) ) <END_BUG> groupRoleDao . delete ( role . getId ( ) ) ; } } } if ( userEdit ) { newPassword = request . getParameter ( "edit_user_new_password" ) ; newPasswordConfirmation = request . getParameter ( "edit_user_new_password_confirmation" ) ; } if ( newFirstname . equals ( "" ) ) return returnEditUserFailure ( "missingFirstname" , user , r , adminEdit , userEdit , recordGroups , recordGroupValues , request , model ) ; if ( newLastname . equals ( "" ) ) return returnEditUserFailure ( "missingLastname" , user , r , adminEdit , userEdit , recordGroups , recordGroupValues , request , model ) ; if ( ( ! ( user . getEmail ( ) . equals ( newEmail ) ) ) && ( ( userDao . findByEmail ( newEmail ) ) != null ) ) return returnEditUserFailure ( "emailExists" , user , r , adminEdit , userEdit , recordGroups , recordGroupValues , request , model ) ; if ( ( newEmail . equals ( "" ) ) || ( ! ( newEmail . matches ( "^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\\.[a-zA-Z0-9-.]+$" ) ) ) ) return returnEditUserFailure ( "invalidEmail" , user , r , adminEdit , userEdit , recordGroups , recordGroupValues , request , model ) ;

Fix:
if ( ( role != null ) && ( role . getRoleType ( ) . equals ( "admin" ) ) )